So, the merchant's got in touch with you.
They've said that our acquiring bank's told us we've got a data breach.
Can you help us?
What are you going to ask the merchant to do before you get onsite?
Are you going to give them any advice?
Yeah.
There's a number of things that they can do to prepare for a PFI investigation.
One of the first things, take a big, deep breath because it's a process.
But we'll have an initial call with a merchant,
and we'll find out the size of their network,
what they know about the breach at that point.
We'll ask for things, like network diagrams,
just so we can understand the network as much as we can before we go onsite.
Or if it's an e-commerce,
we'll figure out how many websites are in scope of the breach,
and basically determine how much evidence gathering
equipment we need to bring with us.
Once we arrive onsite, it's a fairly straightforward process.
I like to gauge the emotional status of the merchant because a lot of
them are really stressed out when this happens.
It's not fun to have somebody show up to investigate you, right?
I'd be stressed.
So, I like to put the merchant at ease and talk them down off the ledge,
so to speak.
Let them know that this is just part of a process.
It happens.
I'm not there to point fingers at anybody.
I'm there to find out what just happened,
how it happened, and how to make sure it doesn't happen again.
So I am there to help.
And the thing I should make clear on a PFI is that
you're there for multiple reasons.
So, with my card brand task, from when I used to work for a card brand,
as a card brand,
we want to know which of our cards have been compromised because then we,
as the card brand, can go and tell the issuing banks to stop those cards,
which will stop the fraud happening.
So our most important thing, number one,
is tell me all the cards that we know were compromised.
We don't really care to begin with what happened and why it happened and
who was at fault because the thing we're trying to do is to reduce harm
to people and to the payment ecosystem.
So, from a card brand perspective,
I was always like waiting for what we called the window of compromise.
When did the bad guys get in?
Are they still there?
Have you got rid of them?
So that was our motivation, and everyone thinks it's completely different,
but the motivation was to find out how long that was.
Is that the first thing you look at as a PFI is window of compromise?
Well, we look at a number of things, but we actually need to mention a point.
One of the things the merchant needs to do is preserve the evidence.
A lot of times, people, it's just the human trait that they want to go into COA,
cover your assets, and maybe obfuscate some of the things that happened.
That's the worst reaction.
That's the worst thing a merchant can do.
Why is that though because then maybe you're not
going to find bad things about them.
Due to the nature of the forensic evidence,
it's very difficult to eliminate all of it.
What you'll do is just make them more, investigation more difficult,
more costly, more time consuming,
and we're probably going to find evidence of bad acting whether
it's on the part of the merchant or on the part of the
attackers that are hitting that network.
So we want to preserve, as closely as possible,
the evidence as it was at the time of the breach.
The merchant, of course,
has the desire to be secure as soon as possible so they
can do things like rename the malware,
but not delete the malware and get rid of it so nobody can find it.
So let's play this out.
So imagine I'm the merchant.
I've rung you up.
I've said, look, my acquiring bank's told me I've got a breach.
What are you going to tell me to do?
Are you going to tell me to turn the machines off?
Are you going to tell me to stop trading?
Are you going to tell me to unplug stuff?
What should I do?
Well, you want to keep mission critical infrastructure running, right?
You don't want to go out of business because somebody hacked you.
What you want to do is stop the bleeding of the cards.
So if you have the appropriate IT on hand,
you can go in and look at your systems and maybe you have
some easily identifiable malware running.
You can go in and remove that,
but that malware needs to be preserved so a forensic analyst can
look at it later and determine its origin,
the nature of that malware.
What we don't like to see is, oh, we wiped the system.
Okay.
So as a merchant, you're asking me to keep stuff running and not turn it off.
You're asking me, if I've got the skills, to go in and try and stop the breach.
To maybe write down what I'm doing?
Yes, document everything you do so that you can say to the PFI,
here are the steps we took to stop the bleeding of the card data.
Okay, so even if I've made something, done something really stupid at that stage,
at least I've written it down and told you what I've done,
but I'm acting in good faith.
Correct,
and you don't want to turn off the computer because a lot
of times malware is running in-memory,
and we want to be able to come onsite and take a download of that
memory so that we can do an analysis there as well.